registry / 0xray / 4.1.2

0xray@4.1.2

Three-subsystem autonomous engine. The suit powers the agent you already run: memory, judgement, payments, and the wake.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Source inspection did not establish malicious install-time behavior. The separate bridge setup capability can add package-provided MCP servers to an agent plugin, so retain a warning for the unresolved extension setup risk.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Explicit invocation of the bridge setup helper.

Impact

That plugin may load the configured MCP servers when used.

Mechanism

The helper writes an MCP configuration into an existing plugin directory.

AI rationale

Evidence

scripts/node/install-bridges.cjs.mcp.json

Decision evidence

public snapshot

AI called this Suspicious at 68.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package has an npm postinstall hook, whose runner links vendored Repertoire and prints a separate wear command.
A bridge setup helper can write an MCP configuration into an agent plugin directory; its activation through an npm install hook was not established.
The CLI wear command delegates to a Cursor hook script.

Evidence against

The postinstall runner does not call the bridge setup helper; the inspected runtime path only links the vendored package and prints the wear command.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 602 file(s), 5.75 MB of source, external domains: 0xray.ai, 127.0.0.1, api.example.com, api.github.com, auth.x.ai, codeload.github.com, example.com, github.com, img.shields.io, mcp-production-80e2.up.railway.app, opencode.ai, registry.npmjs.org, schema.getpostman.com, schema.org, www.google.com, www.sitemaps.org, www.typescriptlang.org, your-governance-endpoint.com

Source & flagged code

25 flagged

package.jsonView file

•scripts.postinstall = node scripts/node/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/node/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/security/security-scanner.jsView file

6*/ L7: import { exec } from "child_process"; L8: import { promises as fs } from "fs";

High

Child Process

Package source references child process execution.

dist/security/security-scanner.jsView on unpkg · L6

11import { promptSecurityValidator, } from "./prompt-security-validator.js"; L12: const execAsync = promisify(exec); L13: export class SecurityScanner {

High

Shell

Package source references shell execution.

dist/security/security-scanner.jsView on unpkg · L11

dist/core/boot-orchestrator.jsView file

172try { L173: orchestratorModule = await import("../core/orchestrator"); L174: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/boot-orchestrator.jsView on unpkg · L172

scripts/node/postinstall.cjsView file

31function renderManagedAgents(packageRoot, targetDir) { L32: let content = fs.readFileSync(path.join(packageRoot, "AGENTS-consumer.md"), "utf8"); L33: const consumer = readPackageIdentity(path.join(targetDir, "package.json")); ... L60: } L61: fs.writeFileSync(filePath, body); L62: return true; ... L65: function deployManagedAgents(packageRoot, targetDir, log) { L66: const agentsConsumer = path.join(packageRoot, "AGENTS-consumer.md"); L67: const agentsDest = path.join(targetDir, "AGENTS.md"); L68: if (!fs.existsSync(agentsConsumer)) return; ... L76: if (!parts || outsideRegionEdited(parts)) { L77: const side = path.join(targetDir, "AGENTS.md.0xray-new");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/node/postinstall.cjsView on unpkg · L31

dist/scripts/pre-command.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { existssync, mkdirsync, writefilesync, readfilesync } from "fs";

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/scripts/pre-command.mjsView on unpkg

scripts/node/install-bridges.cjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. linkeddir = false; if (entry.issymboliclink()) { try { linkeddir = fs.statsync(path.join(sourcedir, entry.name)).isdirectory(); } catch { linkeddir = false; } } if (!entry.isdirectory() && !linkeddir) continue; const skillmd = path.join(sourcedir, entry.name, "skill.md"); if (!fs.existssync(skillmd)) continue; const destmd = path.join(targetskillsdir, entry.name, "skill.md"); const destdir = path.dirname(destmd); if (!fs.existssync(destdir)) fs.mkdirsync(destdir, { recursive: true }); if (fs.existssync(destmd) && fs.statsync(skillmd).mtime <= fs.statsync(destmd).mtime) { wea

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/node/install-bridges.cjsView on unpkg

dist/integrations/hermes-agent/bridge.mjsView file

957const { execSync } = await import("child_process"); L958: const output = execSync(`npx 0xray skill:install "${source}"`, { cwd: projectRoot, timeout: 120000 }).toString(); L959: return { status: "ok", output: output.trim() };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/integrations/hermes-agent/bridge.mjsView on unpkg · L957

dist/integrations/cursor/hooks/pre-compact.shView file

•path = [redacted]-compact.sh kind = build_helper sizeBytes = 130 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/integrations/cursor/hooks/pre-compact.shView on unpkg

.opencode/init.shView file

•path = .opencode/init.sh kind = payload_in_excluded_dir sizeBytes = 8140 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/init.shView on unpkg

dist/cli/index.jsView file

•path = dist/cli/index.js kind = trigger_reachable_excluded_payload sizeBytes = 44196 triggerReachableSource = dist/cli/index.js excludedPayload = .opencode/init.sh

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

dist/cli/index.jsView on unpkg

dist/core/framework-logger.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 19

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/framework-logger.jsView on unpkg

dist/cli/commands/mcp-install.jsView file

•matchType = normalized_sha256 matchedPackage = 0xray@4.0.28 matchedPath = dist/cli/commands/mcp-install.js matchedIdentity = npm:MHhyYXk:4.0.28 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High